{"id":"CVE-2026-120278","kind":"vulnerability","aliases":["CVE-2026-120278"],"related":[],"title":"WAVLINK WN536AX6-A router: VPN client list handler lacks authentication","description":"A vulnerability was detected in WAVLINK WN536AX6-A V260507_2.0.0. Impacted is the function sub_416d48/sub_41a7c0 of the file /bin/ioos of the component VPN Client List Handler. Performing a manipulation of the argument opt results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.","summary":"A flaw in the VPN Client List Handler of the WAVLINK WN536AX6-A router firmware lets a remote attacker manipulate the opt argument without authentication. A public exploit exists, so an attacker may be able to reach router functions they should not control.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","iot","router","wavlink","wn536ax6-a"],"not_affected_if":["no-remote-access","other-firmware-version"],"how_to_check":"- Check the firmware version on the router admin page and compare it with `V260507_2.0.0`\n- Confirm whether remote administration or VPN features are exposed to the internet","fix":null,"status":"open","published_at":"2026-11-02T00:18:11+00:00","first_seen_at":"2026-11-02T00:22:57+00:00","triaged_at":"2026-11-02T00:23:50+00:00","updated_at":"2026-11-02T00:23:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-02T00:23:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WAVLINK WN536AX6-A router: VPN client list handler lacks authentication","impact":"medium","summary":"A flaw in the VPN Client List Handler of the WAVLINK WN536AX6-A router firmware lets a remote attacker manipulate the opt argument without authentication. A public exploit exists, so an attacker may be able to reach router functions they should not control.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["wavlink","wn536ax6-a","router","iot"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker bypasses authentication on the router's VPN client handler remotely","analyst_note":"Confirm whether the VPN Client List Handler is reachable from WAN by default and whether WAVLINK has released a fixed firmware version.","how_to_check":"- Check the firmware version on the router admin page and compare it with `V260507_2.0.0`\n- Confirm whether remote administration or VPN features are exposed to the internet\n- unknown for other checks, as the sources do not say","plain_action":"If you own a WAVLINK WN536AX6-A router, check its firmware version and wait for WAVLINK to publish an update.","needs_analyst":true,"not_affected_if":["other-firmware-version","no-remote-access"],"who_is_affected":"Devices running WAVLINK WN536AX6-A firmware V260507_2.0.0 are affected, specifically the /bin/ioos VPN Client List Handler. Exposure depends on whether the router's management or VPN interface can be reached remotely. Sources do not say whether other firmware versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000728,"input_tokens":4163,"output_tokens":624,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120278':14A,17A '-2026':13A,16A '/bin/ioos':88C '2.0.0':78C '416d48/sub_41a7c0':84C 'abl':59B 'argument':47B,101C 'attack':43B,56B,108C 'authent':11A,49B,106C 'client':7A,29B,93C 'compon':91C 'contact':125C 'control':67B 'cve':12A,15A 'detect':71C 'disclosur':129C 'earli':126C 'exist':53B 'exploit':52B,114C 'file':87C 'firmwar':39B 'flaw':25B 'function':63B,82C 'handler':9A,31B,95C 'impact':79C 'infrastructur':18B 'initi':111C 'iot':19B 'lack':10A 'let':40B 'list':8A,30B,94C 'manipul':44B,98C 'may':57B,119C 'miss':105C 'opt':46B,102C 'perform':96C 'public':51B,117C 'reach':61B 'remot':42B,112C 'result':103C 'router':5A,20B,38B,62B 'sub':83C 'use':121C 'v260507':77C 'vendor':123C 'vpn':6A,28B,92C 'vulner':69C 'wavlink':1A,21B,34B,73C 'without':48B 'wn536ax6':3A,23B,36B,75C 'wn536ax6-a':2A,22B,35B,74C","nicknames":[],"mitigations":[],"who_affected":"Devices running WAVLINK WN536AX6-A firmware V260507_2.0.0 are affected, specifically the /bin/ioos VPN Client List Handler. Exposure depends on whether the router's management or VPN interface can be reached remotely. Sources do not say whether other firmware versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a WAVLINK WN536AX6-A router, check its firmware version and wait for WAVLINK to publish an update.","first_public_at":"2026-11-02T00:18:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120278","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120278","severity":null,"published_at":"2026-11-02T00:18:11+00:00","modified_at":"2026-11-02T00:18:11+00:00","first_seen_at":"2026-11-02T00:22:57+00:00","fetched_at":"2026-11-02T00:22:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}